diff --git a/docs/ADMIN.md b/docs/ADMIN.md
index 48e32143..b871b7a6 100644
--- a/docs/ADMIN.md
+++ b/docs/ADMIN.md
@@ -10,7 +10,9 @@ with OAuth2/OIDC through Pocket ID. Require the Pocket ID user group
 `familyfed_admin`. The generated page has `noindex`, but a static page cannot
 enforce a secure admin login by itself.
 
-See `docs/OAUTH2-AUTH.md` for the exact proxy/auth requirements.
+If Pocket ID says `Invalid callback URL`, the FamilyFed Admin OIDC client must
+allow `https://admin.familyfed.ie/oauth2/callback`. See `docs/OAUTH2-AUTH.md`
+for the exact proxy/auth requirements.
 
 ## Content changes
 
diff --git a/docs/OAUTH2-AUTH.md b/docs/OAUTH2-AUTH.md
index 1ccd6c87..e897292d 100644
--- a/docs/OAUTH2-AUTH.md
+++ b/docs/OAUTH2-AUTH.md
@@ -1,8 +1,8 @@
 # OAuth2/OIDC auth for admin.familyfed.ie
 
 `admin.familyfed.ie` must be protected before traffic reaches the static Astro
-files. Use Pocket ID as the OIDC issuer, with an OAuth2/OIDC proxy in front of
-the generated admin page.
+files. Use Pocket ID as the OIDC issuer, with an oauth2-proxy sidecar in front
+of the generated admin page.
 
 Required policy:
 
@@ -20,14 +20,14 @@ Create a Pocket ID OIDC client:
 - Scopes: `openid email profile groups`
 - Allowed user group: `familyfed_admin`
 
-The redirect URL must exactly match the OAuth2 proxy config. If the proxy is
+The redirect URL must exactly match the oauth2-proxy config. If the proxy is
 mounted on a different hostname or path, use that callback URL in both places.
 
 ## OAuth2 proxy setup
 
-Run an OAuth2/OIDC proxy in front of the static admin output. The proxy should
-receive all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check
-the `groups` claim, and only then forward to the static admin page.
+Run oauth2-proxy in front of the static admin output. The proxy should receive
+all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check the
+`groups` claim, and only then forward to the static admin page.
 
 Example `oauth2-proxy` arguments: